Submit #1005484: AUTOMATIC1111 stable-diffusion-webui v1.10.1 Allocation of Resources Without Limits or Throttling

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui v1.10.1 (commit 82a973c04367123ae98bd9abdf80d9eda9b910e2; the same code is still on master as of 2026-09-29) and classified as medium 6.4. Affected is read_metadata_from_safetensors() in modules/sd_models.py, reached from CheckpointInfo/list_models() during every model enumeration. The manipulation of the 8-byte declared header length field at the start of a .safetensors file leads to unbounded resource allocation (file.read(metadata_len-2) with no cross-check against the real file size, CWE-770). It is possible to launch the attack remotely in the sense that the crafted model file is delivered the usual way models are shared; an operator must then place it in the models directory (user interaction required).

Technical Details
- Affected file/function: modules/sd_models.py / read_metadata_from_safetensors() (lines 284-309; sink at line 297), called via CheckpointInfo.__init__ and cache.cached_data_for_file during list_models()
- Vulnerable parameter: 8-byte little-endian header length field of a .safetensors file
- Attack vector: Network (crafted model file distribution); Privileges required: None
- Trigger condition: the crafted file is present in models/Stable-diffusion/ (or the --ckpt-dir) when the WebUI enumerates checkpoints at startup or on refresh; a 40-byte file declaring 2^40 or 2^46 header bytes forces an attacker-sized read/allocation attempt inside the WebUI process at every enumeration

Impact
- Confidentiality: None
- Integrity: None
- Availability: Low (proven: MemoryError raised inside the product at modules/sd_models.py:297 for each crafted file, caught by the product's own except Exception; metadata of crafted files denied and oversized allocation attempts repeated at every startup/refresh; the process stays up and keeps serving GET /sdapi/v1/sd-models; a full denial of service was not observed and is not claimed)

CVSS v3.1
Score: 6.4 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Timeline
- Discovered: 2026-09-29
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Bound the declared length by the real file size (os.fstat) before the read and enforce the safetensors ecosystem's absolute header cap (100 MB) as the official parser does, or delegate metadata extraction to the safetensors library. Interim workaround: do not place untrusted model files in the models directory.

• Source: ⚠️ https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17498
• User: r1ck99 (UID 100733)
• Submission: 09/29/2026 18:18 (29 days ago)
• Moderation: 10/17/2026 23:49 (18 days later)
• Status: Accepted
• VulDB entry: 421651 [AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 Metadata Extraction modules/sd_models.py read_metadata_from_safetensors header length field allocation of resources]
• Points: 20